Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/medy-gribkov/arcana/fullstack-developernpx skills add medy-gribkov/arcana --skill fullstack-developergit clone --depth 1 https://github.com/medy-gribkov/arcanaWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00072 | $0.01700 |
| Opus 5 | $0.00036 | $0.00850 |
| Sonnet 5 | $0.00014 | $0.00340 |
| Haiku 4.5 | $0.00007 | $0.00170 |
Grade A, and why
fullstack-developer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 241 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Full-Stack Developer
Act as a senior full-stack engineer. Write type-safe, production-ready code with proper error handling, validation, and separation of concerns.
API Design Workflow
Follow these steps when building any API endpoint.
- Define the route, HTTP method, and response shape first
- Create a Zod schema for request validation
- Implement the handler with typed request/response
- Add error handling that returns consistent JSON
- Write the corresponding client-side fetch hook
BAD: Unvalidated, untyped handler
// No validation, raw any types, inconsistent errors
app.post("/api/posts", async (req, res) => {
const post = await db.post.create({ data: req.body });
res.json(post);
});
GOOD: Validated, typed, consistent errors
import { z } from "zod";
const CreatePostSchema = z.object({
title: z.string().min(1).max(200),
content: z.string().min(1),
published: z.boolean().default(false),
});
type CreatePostInput = z.infer<typeof CreatePostSchema>;
app.post("/api/posts", async (req: Request, res: Response) => {
const result = CreatePostSchema.safeParse(req.body);
if (!result.success) {
return res.status(422).json({
error: "Validation failed",
details: result.error.flatten().fieldErrors,
});
}
const post = await prisma.post.create({ data: result.data });
return res.status(201).json({ data: post });
});
Error Response Shape
Every error response must follow this structure:
interface ApiError {
error: string;
code?: string;
details?: Record<string, string[]>;
}
Map status codes consistently:
201after successful creation204after successful deletion (no body)400malformed request,422valid JSON but failed validation401missing auth,403insufficient permissions409conflict (duplicate unique field)429rate limited
React Component Patterns
Follow these steps when building any component.
- Define the props interface with explicit types
- Handle all states: loading, error, empty, success
- Extract data fetching into custom hooks
- Keep components under 80 lines. Split if larger
- Co-locate types, hooks, and tests with the component
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 241 lines · 0 tokens per session scan A 61f9b994b34f
fullstack-developer is a skill published in the GitHub repository medy-gribkov/arcana (1 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 72 tokens to every session and 1,700 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ultimate-seo-geo
Audits and optimizes websites for search engine visibility (SEO) and AI search citation (GEO), covering technical health, E-E-A-T content scoring, domain authority, structured data, rich results, and entity signals. Use when running SEO audits, diagnosing traffic drops or ranking losses, generating Schema.org JSON-LD…
neo-stop-slop
Use this skill when the user wants to polish, rewrite, shorten, or review prose so it sounds natural rather than AI-generated. Trigger for Traditional Chinese or English drafts, rough notes, source material, articles, technical docs, code comments, commit messages, PR descriptions, sales copy, or requests to remove AI…
neo-iso-27001
Use this skill when the user needs to establish, review, or improve an ISO/IEC 27001 ISMS, perform information security risk discovery, define scope, create an evidence matrix, conduct a gap analysis, draft a Statement of Applicability, prepare for an internal audit, or create an improvement plan. Use neo-iso-27701…
neo-iso-27701
Use this skill when the user needs to establish, review, or improve an ISO/IEC 27701 PIMS, inventory PII processing, analyze controller and processor responsibilities, create a privacy risk or evidence matrix, conduct a gap analysis, prepare for an audit, or create an improvement plan. Use neo-iso-27001 when the main…
neo-azure-pipelines
Use this skill when the user asks to create, review, debug, or modernize Azure Pipelines YAML for CI/CD, especially .NET builds, Azure App Service deploys, or IIS/on-premises deploys. Prefer bundled templates and verify task syntax against Microsoft docs when version-specific accuracy matters.
neo-clean-architecture
Use this skill when the user wants to design, implement, review, or refactor software systems conforming to Clean Architecture principles. It structures code into Domain, Application, Infrastructure, and Presentation/API layers, enforcing inward-only dependencies. It advocates rich domain models, CQRS, and the Result…